JP2010062844A - Network monitoring system, and node device and monitoring apparatus thereof - Google Patents

Abstract

An object of the present invention is to effectively suppress traffic related to notification of alarm information.
Network nodes N1 to Nm are provided with buffers 151 to 15n for each alarm level, and alarm information is stored in the buffer when an alarm suppression flag is on. Each buffer is periodically checked to give priority to high level alarm information. At that time, transmission, arrival, reply, and reception time of the keep alive message are given to the message by a time stamp, and the load on the monitoring device 3 and the network NW is measured from each time information, and this is reflected to reflect the buffer 151. The buffering period of 15n is variably controlled.
[Selection] Figure 2

Description

  The present invention relates to a network monitoring system including a monitored device (network node) forming a network and a monitoring device that monitors these monitored devices via the network, and a node device and a monitoring device provided in the system. .

  In order to keep the network in a healthy state and facilitate smooth operation, a device (hereinafter referred to as a monitoring device) for monitoring the status of network components (hereinafter referred to as network nodes) is provided. When an event such as the occurrence of a failure or recovery from a failure occurs, the network node notifies the monitoring device of a message such as an alarm. The monitoring device grasps the state of the network based on such a message (hereinafter collectively referred to as alarm information). A typical example of this type of protocol is SNMP (Simple Network Management Protocol), which is easy to implement, but various other technologies are also used. In this type of technology, reduction of the load related to management is a major theme. For example, Patent Literatures 1 to 3 disclose related technologies.

Patent Document 1 discloses a technique for preventing the same alarm state from fluttering and minimizing event notification traffic by making a notification condition that an event continues for a certain period of time.
In Patent Document 2, the monitoring device (NMS server) monitors the load per unit time, and if the load becomes excessive, the alarm notification processing of the alarm notification server (NE server) is suppressed. According to this, it is possible to perform alarm notification in consideration of the load on the monitoring device.
In Patent Document 3, a network node (monitored device) cannot notify an alarm unless it is permitted by the monitoring device. When the monitoring device gives a permission by comparing the number of received packets monitored by itself and the processing capability, it is possible to perform an alarm notification in consideration of the load on the monitoring device. In particular, in this document, alarm notification is completely stopped when not permitted.
JP 2000-278361 A JP 2001-223694 A JP-A-9-214494

  When notifying an alarm from a network node to a monitoring device, various methods for reducing the burden on the monitoring device by mainly reducing traffic are being sought. In recent years, however, the number of monitoring targets has increased with the increase in the scale of communication systems, and the load on the monitoring device tends to increase. Depending on the type of failure that has occurred, a large number of alarms may be notified from many nodes in a short period of time (burst). In such a case, the processing capacity cannot catch up and the alarm notification may be lost or network congestion may occur. Can also happen. A more effective method for monitoring a network based on alarm notification is desired.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide a network monitoring system capable of effectively suppressing traffic related to alarm information notification, its node device, and monitoring device.

  In order to achieve the above object, according to one aspect of the present invention, a system including a communication network connecting a plurality of node devices is monitored based on a notification message notified from the plurality of node devices via the communication network. In the network monitoring system including the monitoring device, each of the node devices is provided for each of the different levels, and a message generation unit that generates a notification message having a different level according to the type of alarm generated in the own device. A plurality of buffer units that temporarily hold a notification message in a holding period according to the level, a notification unit that notifies the monitoring device of the held notification message, a load on the monitoring device, and a load on the communication network A test signal transmitter for transmitting to the monitoring device a test signal for measuring Based on the measurement unit that individually measures the load on the monitoring device and the communication network based on the reception time of the reply from the monitoring device to the test signal, and on the basis of the measured load on the monitoring device and the load on the communication network A holding period control unit that changes the holding period in the plurality of buffer units for each level, and the monitoring device receives the test signal and describes a response to the test signal in the test signal. There is provided a network monitoring system including a transmission / reception unit for replying.

  By taking such means, the node device buffers the notification message for each alarm level, and notifies it with a time difference from the occurrence of the failure. In other words, the notification message is not sent immediately after the occurrence of the alarm, but the notification is suppressed according to the alarm level. In other words, alarms with a higher degree of urgency are notified immediately, and alarms that are less important are postponed, so that sudden traffic increases can be suppressed.

  On the other hand, for example, the node device periodically sends a keep alive message to the monitoring device. The load on the monitoring device and the communication network can be measured from the difference between the transmission time of the keep alive message and the reception time returned from the monitoring device. Furthermore, the magnitude of the load on the monitoring device can be measured according to the length of time that the keep-alive message stays in the monitoring device. If these are known, the network load can be independently evaluated by subtracting the latter from the former. The inventors pay attention to this point, and in particular, by changing the buffering period (holding period) of the buffer according to the network load, it is possible to realize an operation in which an important alarm is not notified when the network load is high. become able to. From this, it becomes possible to carry out alarm notification in a more effective form.

  According to the present invention, it is possible to provide a network monitoring system capable of effectively suppressing traffic related to notification of alarm information, its node device, and monitoring device.

  FIG. 1 is a system diagram showing an embodiment of a network monitoring system according to the present invention. In FIG. 1, a plurality of network nodes N <b> 1 to Nm belong to a network NW, and these communicate bidirectionally with a monitoring device 3 via a router 2. Based on the notification information notified from the network nodes N1 to Nm, the monitoring device 3 monitors the operation state of each network node N1 to Nm, the state of the network NW, and the state of the system formed by these. For example, SNMP is a representative monitoring protocol, but the monitoring protocol is not limited to this.

  FIG. 2 is a functional block diagram showing an embodiment of the monitoring device 3 of FIG. 1 and the network nodes N1 to Nm. Among these, the network nodes N1 to Nm include a failure detection unit 23, a failure-alarm conversion table 22, an alarm information generation unit 21, an alarm suppression availability table 20, an alarm buffer 15, an alarm suppression determination unit 19, an alarm combination unit 14, and non-suppression. Buffer 16, non-suppression buffer management unit 17, timer management unit 18, timer value table 12, alarm transmission unit 10, transmission buffer 13, and keep-alive transmission / reception unit 11.

  The failure detection unit 23 detects the occurrence and recovery of a failure in its own node. The alarm information generation unit 21 converts the detected failure into alarm information using a failure-alarm conversion table 22 as shown in FIG. Convert. The alarm information is notified to the monitoring device 3 as a notification message. Each alarm information is given a sequential number in the order of occurrence. Using this sequential number, it is determined whether there is any missing alarm information.

  The failure-alarm conversion table 22 shown in FIG. 3 is a table in which alarm information (message) and level are associated with each failure. The level is a priority order for notifying the monitoring device 3, and is defined for each alarm information. For example, there are three levels of Major / Minor / Warning. Among them, Warning is the highest level (level-1), and the level decreases in the order of Major (level-2) and Minor (level-3).

  The alarm buffer 15 is a buffer memory provided for temporarily storing alarm information, and includes a plurality of buffers 151 to 15n provided for each level of alarm information. The period (buffering time) for holding the alarm information in each of the buffers 151 to 15n has a different value for each level. Further, a flag indicating whether or not an alarm has occurred is associated with each of the buffers 151 to 15n.

  The alarm suppression availability table 20 is a table for designating for each alarm whether or not to suppress transmission of alarm information to the monitoring device 3. That is, as shown in FIG. 4, each alarm is individually designated as to whether or not to suppress notification. In a state where transmission of alarm information to the monitoring device 3 is suppressed, an alarm occurrence flag is set for distinction.

  The alarm suppression judgment unit 19 receives alarm information to the monitoring device 3 from the alarm suppression enable / disable table 20, the status of the alarm buffer 15, the status of the alarm occurrence flag, and the status of the alarm generated in the network node. It is determined whether to suppress the transmission of.

  The alarm combination unit 14 periodically checks whether there is alarm information in each of the buffers 151 to 15n. If a plurality of pieces of alarm information are buffered in the same buffer, the alarm combination unit 14 combines these pieces of alarm information into an alarm message to be transmitted to the monitoring device 3.

  The non-suppression buffer 16 is a buffer for temporarily holding alarm information determined to be unnecessary to suppress transmission. In other words, the alarm information determined by the alarm suppression determination unit 19 not to suppress transmission based on the alarm level is also buffered here. In this embodiment, alarm information transmission suppression control is performed in consideration of the network load in addition to the monitoring device 3. In other words, transmission of alarm information is controlled in two steps. For example, the buffer period at no load is 0.

  The non-suppression buffer management unit 17 periodically checks whether there is alarm information being generated in the non-suppression buffer 16, and if alarm information is present, processes the information and sends it to the monitoring device 3. Generate an alarm message. The timer management unit 18 notifies the alarm coupling unit 14 of the periodic check timing of the alarm buffer 15. In addition, the timer management unit 18 notifies the non-suppression buffer management unit 17 of the periodic check timing of the non-suppression buffer 16. The timing of the periodic check of the alarm buffer 15 and the non-suppression buffer 16 is performed at intervals designated by the alarm level in the timer value table 12.

  The alarm transmitter 10 transmits an alarm message to the monitoring device 3. At that time, the transmitted alarm message is temporarily held in the transmission buffer 13. The keep alive transmission / reception unit 11 periodically transmits a keep alive message to the monitoring device 3 in order to perform keep alive. The keep-alive transmission / reception unit 11 receives the keep-alive response and checks the survival of the monitoring device 3 by checking it. The keep alive function is one of applications installed in a device for checking the operation of a network device, and is a well-known technique in an IP (Internet Protocol) telephone system.

  In particular, in this embodiment, the keep alive transmission / reception unit 11 describes time information in the keep alive message, and measures the load on the monitoring device 3 and the load on the network NW based on the time information. In other words, in this embodiment, the keep alive message is used as a test signal for measuring the load.

  The monitoring device 3 includes an alarm receiving unit 31, an alarm disassembling unit 32, an alarm sorting unit 33, an alarm display unit 34, and a keep alive transmission / reception unit 35. Among these, the alarm receiver 31 receives the alarm message transmitted from the network nodes N1 to Nm. If a plurality of alarm information is combined with the received alarm message, the alarm decomposing unit 32 extracts the individual alarm information by decomposing the alarm information. The alarm sort unit 33 sorts the individual alarm information in the order of time stamps. The alarm display unit 34 displays alarm information on a monitor screen (not shown) and notifies the maintenance person. The keep alive transmission / reception unit 35 receives the keep alive message from the network nodes N1 to Nm, and returns a response message to the transmission source network node.

  FIG. 5 is a diagram showing an example of a message format of the keep alive message used in this embodiment. In this embodiment, the keep alive message includes a field for describing time information (time stamp) in addition to a field for describing a message identifier (ID) and known data for keep alive.

  That is, the keep-alive transmission / reception unit 11 of the network nodes N1 to Nm describes the transmission time of the keep-alive message in the transmission time field and transmits it to the monitoring device. The keep-alive transmission / reception unit 35 of the monitoring device 3 that has received the response adds a time when this message arrives via the network NW (arrival time) and a time when the message is returned to the sending network node (reply time). The message is returned to the sending network node. The network node that has received the message describes the reception time in the message field, and then proceeds to the next processing. Note that the last reception time is not necessarily described, and it is only necessary for the network node to know the reception time of the response message. Thus, knowledge about the load of the network NW can be obtained in addition to the load state of the monitoring device 3 by the network node acquiring the time data via the keep-alive message.

  FIG. 6 is a diagram illustrating an example of time information described in the keep-alive message. FIG. 6 shows an example of transmission time (T1), arrival time (T2), return time (T3), and reception time (T4) described in three keep-alive messages. The unit is, for example, milliseconds.

  The processing load of the monitoring device 3 can be estimated by the time from receiving the keep-alive message to processing and returning the message. In other words, the longer the processing time (T3-T2), the higher the load. The load on the network NW can be estimated by the transmission time of the keep alive message. That is, the longer the transmission takes, the higher the load on the network NW. The transmission time can be calculated by adding the transmission time (T2-T1) at the time of keep-alive transmission and the transmission time (T4-T3) at the time of reply. Or, in short, it can be calculated by subtracting the processing time (T3-T2) of the monitoring device from the difference (T4-T1) between the reception time T4 and the transmission time T1.

  In FIG. 6, for example, a threshold of 10 milliseconds is set for the processing time and the transmission time, and the load level can be estimated based on this threshold. In the first case of FIG. 6, both the processing time and transmission time exceed the threshold value, and it can be seen that both the monitoring device 3 and the network NW are heavily loaded for some reason. In the next case, the load on the monitoring device 3 and the network NW is light, and in the third case, the load on the network 3W is light, but the load on the monitoring device 3 is high. Such information is measured by the keep-alive transmission / reception unit 11, and based on the result, the timer management unit 18 variably controls the holding period of the buffers 151-15n. Thereby, detailed alarm transmission suppression control can be performed according to the form of the load.

  FIG. 7 is a flowchart showing a processing procedure from the occurrence of a failure in the network nodes N1 to Nm until the alarm information is stored in the buffer. In FIG. 7, when the occurrence of a failure is detected by the failure detection unit 23 (step B1), the alarm information generation unit 21 refers to the failure-alarm conversion table 22 to generate alarm information from the failure information (step B2). . This alarm information includes an alarm type, an alarm level, a time stamp, a detection location, and the like. This alarm information is passed to the alarm suppression judgment unit 19.

  The alarm suppression determination unit 19 changes the alarm generation flag at the level of the alarm information passed to ON (step B3). As a result, the transmission of an alarm having a level lower than this level is suppressed. Next, the alarm suppression determination unit 19 refers to the alarm suppression enable / disable table 20 and determines whether to suppress notification based on the level of the generated alarm information (step B4). If notification suppression is not necessary, the alarm suppression determination unit 19 stores this alarm information in the non-suppression buffer 16 (step B10).

  If notification suppression is necessary, the alarm suppression determination unit 19 checks all alarm occurrence flags that are higher than the alarm level (step B6). If any of the alarm generation flags is on, a higher level alarm is being generated, so the alarm suppression determination unit 19 determines that transmission of the passed alarm information is also suppressed (step B7). As a result, this alarm information is stored in the alarm buffer 15 at the corresponding level (step B8).

  On the other hand, if all higher level alarm occurrence flags are off in step B7, the alarm suppression judgment unit 19 checks the state of the alarm buffer 15 at the target alarm level (step B12). If the alarm buffer 15 at the target alarm level is empty (YES in step B12), the alarm suppression determination unit 19 determines that there is no need to suppress transmission of the target alarm information and stores this alarm information in the non-suppression buffer 16. (Step B10).

  If the alarm buffer 15 is not empty in step B12 (NO), it is determined that transmission is being suppressed at the level of the passed alarm information, and the alarm suppression determination unit 19 stores this alarm information in the alarm buffer 15 of that level ( Step B8). If the buffer regular check timer is not activated in either step B8 or B10, the alarm suppression judgment unit 19 requests the timer management unit 18 to activate the regular check timer (steps B9 and B11).

  FIG. 8 is a flowchart showing a processing procedure from restoration of a failure in the network nodes N1 to Nm to transmission of alarm release. In FIG. 8, when failure recovery is detected by the failure detection unit 23 (step B21), the alarm information generation unit 21 refers to the failure-alarm conversion table 22 and generates alarm release information from the failure information (step S21). B22). This alarm release information includes an alarm type, an alarm level, a time stamp, a detection location, and the like. This alarm release information is passed to the alarm suppression judgment unit 19.

  The alarm suppression judgment unit 19 checks the state of the alarm buffer 15 corresponding to the alarm level described in the passed alarm release information (step B23). If alarm information already exists in the alarm buffer 15, the alarm suppression determination unit 19 determines that alarm transmission at the target alarm level is occurring, that is, waiting for transmission timing, and uses this alarm release information as an alarm buffer. 15 (step B25).

  If there is no alarm information in the alarm buffer 15, the alarm suppression judgment unit 19 refers to the alarm occurrence flag that is higher than the alarm to be canceled (step B26). If any of the alarm occurrence flags is on, transmission of a higher level alarm is occurring (ON in step B26), so that the alarm suppression determination unit 19 determines that transmission of the alarm release information passed is also suppressed. To do. As a result, this alarm release information is stored in the alarm buffer 15 at the corresponding level (step B25). If all the higher-level alarm occurrence flags are off, the alarm suppression determination unit 19 determines whether all the alarms at the target level are canceled by canceling the target alarm (step B27).

  If all alarms are not released (NO in step B27), the alarm suppression judgment unit 19 stores the alarm release information in the target alarm buffer 15 in order to continue the alarm transmission suppression at that level (step B25). If all alarms are released (YES in step B27), the alarm suppression determination unit 19 determines that it is not necessary to continue the alarm transmission suppression of the target level. Accordingly, the alarm suppression judgment unit 19 turns off the alarm occurrence flag of the target level (step B28), requests the timer management unit 18 to stop the periodic check timer of the target alarm level (step B29), and sends this alarm release information Store in the non-suppression buffer 16 (step B30).

  FIG. 9 is a flowchart showing a processing procedure when a timeout of a periodic timer occurs in the network nodes N1 to Nm. Each of the buffers 151 to 15n is periodically checked by a timer. When the timer is timed out (step B41), the timer manager 18 refers to the timer value table 12 for each alarm level and starts a regular timer for the next check (step B42). Next, the timer management unit 18 requests the alarm suppression determination unit 19 to check the alarm buffer 15, and then waits for the next timeout.

  The alarm suppression judgment unit 19 checks the state of the alarm buffer 15 at the level to be periodically checked (step B43). If there is no alarm information in the alarm buffer 15, the process ends. If there is alarm information in the alarm buffer 15 (“Yes” in step B44), the alarm suppression judgment unit 19 cancels all alarms at the target alarm level including the alarm release information stored in the alarm buffer 15. It is confirmed whether or not (steps B45 and B46).

  If all the alarms are released, the alarm suppression determination unit 19 determines that it is no longer necessary to continue the alarm transmission suppression of the target alarm level after the current periodic check. Therefore, the alarm suppression determination unit 19 turns off the alarm occurrence flag at the target alarm level (step B47), and requests the timer management unit 18 to stop the periodic check timer at the target alarm level (step B48). If all the alarms at the target alarm level have not been released (NO in step B46), the alarm suppression determination unit 19 determines to continue the alarm transmission suppression at the target alarm level even after the current periodic check.

  Next, the alarm suppression determination unit 19 checks the number of alarm information stored in the target alarm buffer 15 (step B49). If the alarm information is not one, that is, not plural (NO), the alarm suppression judgment unit 19 requests the alarm transmission unit 10 to transmit an alarm and clears the target alarm buffer 15 (step B51). If there is a plurality of pieces of alarm information, the alarm suppression judgment unit 19 requests the alarm combination unit 14 to combine the alarm information (step B50). In response, the alarm combination unit 14 combines a plurality of pieces of alarm information into one alarm message, requests the alarm transmission unit 10 to transmit an alarm, and clears the target alarm buffer 15 (step B52).

  FIG. 10 is a flowchart showing a processing procedure when the keep-alive message is transmitted in the network nodes N1 to Nm. When the start timing of keep alive comes (step B61), the network node acquires the current time (step B62), writes the value in the transmission time field of the keep alive message, and transmits it to the monitoring device (step B63). ).

  FIG. 11 is a flowchart showing a processing procedure when the keep-alive message is received in the network nodes N1 to Nm. When the network node receives the keep-alive message (step B71), it acquires time information from each field (step B72). Then, as shown in FIG. 6, the load on the network NW and the load on the monitoring device 3 are individually calculated from each numerical value (step B73). Based on the result, the network node changes the timer value for each alarm level set in each buffer (step B74).

  Further, the network node obtains the alarm notification missing information of the keep-alive message returned from the monitoring device 3 (step B75), and if there is a description of the absence (“Yes” in step B76), the corresponding alarm. Information is acquired from the transmission buffer 13 (step B77) and retransmitted to the monitoring device 3 (step B78). When the retransmission of the alarm information is completed, the network node clears the transmission buffer 13 (step B79).

  FIG. 12 is a flowchart showing a processing procedure related to reception and retransmission of keepalive messages in the monitoring device 3. When the monitoring device 3 receives the keep-alive message from the network node (step B91), the monitoring device 3 adds this reception time to the arrival time field (step B92), and checks the sequential number given to each alarm information to check the alarm. It is checked whether or not notification is missing (step B93). If there is a loss, the monitoring device 3 adds a sequential number corresponding to the missing alarm to the keep-alive message sent back to the network node (step B95). Next, after adding the current time to the reply time field (step B96), the monitoring device 3 returns a keep alive response message to the network node (step B97).

  FIG. 13 is a time chart showing the alarm occurrence flag, the state of the alarm buffer 15, and the time series of alarm transmission in this embodiment. First, for example, when a level 2 alarm (Alarm2-1) occurs alone, the level 2 flag is turned on and the buffering timer is started, and then alarm information is immediately transmitted to the monitoring device 3.

  If alarms of each level (Alarm1-1, Alarm2-2, Alarm3-1) are generated simultaneously from this state, the level 1 and 3 flags are turned on and then the timer is started. In the existing technology, any alarm information is transmitted at this point, but in this embodiment, only the highest level Alarm 1-1 is transmitted. This state continues until the level 2 buffer is cleared, and when it is cleared, Alarm 2-2 is transmitted. A similar procedure is performed for releasing the alarm, and transmission of alarm information is suppressed until the buffer corresponding to the alarm level is cleared. In particular, the lowest level (level 3) buffer has the longest timer period, and transmission is suppressed until it is cleared. In this embodiment, the timer check period (buffering period) of each buffer is variably controlled in consideration of the load of the network NW in addition to the load of the monitoring device 3.

  As described above, in this embodiment, the network nodes N1 to Nm are provided with the buffers 151 to 15n for each alarm level, and the alarm information is stored in the buffer when the alarm suppression flag is on. Each buffer is periodically checked to give priority to high level alarm information. At that time, transmission, arrival, reply, and reception time of the keep alive message are given to the message by a time stamp, and the load of the monitoring device 3 and the network NW is measured from each time information, and this is reflected to reflect the buffer 151. The buffering period of 15n is variably controlled.

  In this embodiment, if there is a plurality of alarm information for each of the buffers 151 to 15n, the monitoring device 3 is notified in a combined state. Further, a sequential number is added to the alarm information, the presence or absence of the alarm information is determined based on whether or not this number is missing, and if there is a missing, the monitoring device 3 requests the network node to retransmit.

  In the existing technology, only the load of the monitoring device 3 is monitored, and traffic related to notification of alarm information is suppressed under the initiative of the monitoring device 3. However, there is no known system that takes into consideration not only the monitoring device 3 that receives alarm information, but also the state of the network up to that point. If the network load is excessive, the alarm message may be discarded, and a serious alarm may not be notified to the monitoring device 3. In such a case, the situation is serious because it not only interferes with the operation of the network but also causes a system down.

  On the other hand, according to this embodiment, it is possible to realize transmission suppression control in a form that also takes into account the state of the network NW. In particular, there is a possibility that a packet may be lost when the network traffic is congested, so it may be better not to notify an important alarm. According to this embodiment, such a situation can be dealt with in detail.

  In addition, according to this embodiment, when a plurality of alarms occur, when the network is heavily loaded, or when the monitoring device is heavily loaded, the notification timing is thinned out and the alarm information is also combined and notified. Overload can be prevented and network traffic congestion can also be prevented. Furthermore, the monitoring device 3 can also perform emergency processing without delay by retransmitting the missing alarm notification and preferential notification of a high level alarm. Accordingly, it is possible to provide a network monitoring system capable of effectively suppressing traffic related to notification of alarm information, a node device thereof, and a monitoring device.

  In addition, this invention is not limited to the said embodiment as it is. For example, in this embodiment, the keep-alive message is used as a signal for measuring the load. However, the present invention is not limited to this, and a dedicated probe signal may be set.

  In addition, the present invention can be embodied by modifying the constituent elements without departing from the spirit of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment.

1 is a system diagram showing an embodiment of a network monitoring system according to the present invention. The functional block diagram which shows embodiment of the monitoring apparatus 3 of FIG. 1, and network node N1-Nm. The figure which shows an example of the failure-alarm conversion table 22. FIG. The figure which shows an example of the alarm suppression availability table 20. FIG. The figure which shows an example of the message format of the keep alive message used by embodiment of this invention. The figure which shows an example of the time information described in the keep alive message of FIG. The flowchart which shows the process sequence from the generation | occurrence | production of the failure in network node N1-Nm to storing alarm information in a buffer. The flowchart which shows the process sequence from the recovery of the failure in network node N1-Nm until it transmits alarm cancellation | release. The flowchart which shows the process sequence at the time of timeout of the regular timer in network node N1-Nm. The flowchart which shows the process sequence at the time of the keep alive message transmission in network node N1-Nm. The flowchart which shows the process sequence at the time of the keep alive message reception in network node N1-Nm. 6 is a flowchart showing a processing procedure related to reception and retransmission of a keep alive message in the monitoring device 3; The time chart which shows the time series of the alarm generation flag in the embodiment of this invention, the state of the alarm buffer 15, and alarm transmission.

Explanation of symbols

  NW ... Network, N1 to Nm ... Network node, 2 ... Router, 3 ... Monitoring device, 10 ... Alarm transmission unit, 11 ... Keep-alive transmission / reception unit, 12 ... Timer value table, 13 ... Transmission buffer, 14 ... Alarm coupling unit, DESCRIPTION OF SYMBOLS 15 ... Alarm buffer, 151-15n ... Buffer, 16 ... Non-suppression buffer, 17 ... Non-suppression buffer management part, 18 ... Timer management part, 19 ... Alarm suppression judgment part, 20 ... Alarm suppression enable / disable table, 21 ... Alarm Information generation unit, 22 ... failure-alarm conversion table, 23 ... failure detection unit

Claims (12)

In a network monitoring system comprising a monitoring device for monitoring a system comprising a communication network for connecting a plurality of node devices based on a notification message notified from the plurality of node devices via the communication network,
Each of the node devices
A message generator that generates notification messages of different levels according to the type of alarm that has occurred in the device itself;
A plurality of buffer units that are provided for each different level and temporarily hold the notification message in a holding period according to the level;
A notification unit that notifies the monitoring device of the held notification message;
A test signal transmitter for transmitting a test signal for measuring a load of the monitoring device and a load of the communication network to the monitoring device;
A measuring unit that individually measures the load of the monitoring device and the communication network based on the reception time of the reply from the monitoring device to the test signal;
A retention period control unit configured to change the retention period in the plurality of buffer units for each level based on the measured load of the monitoring device and the load of the communication network;
The monitoring device
A network monitoring system comprising: a transmission / reception unit that receives the test signal and returns a response to the test signal in response to the test signal. The test signal describes a first field for describing a transmission time from the node device, a second field for describing an arrival time at the monitoring device, and a reply time from the monitoring device. And a third field of
The test signal transmission unit describes the transmission time in the first field and transmits the test signal,
The transmission / reception unit describes the arrival time at the monitoring device in the second field, returns the test signal with the return time from the monitoring device in the third field,
The measuring unit measures the load of the monitoring device from the difference between the return time and arrival time described in the returned test signal, and from the difference between the reception time and the transmission time described in the test signal. The network monitoring system according to claim 1, wherein a load on the communication network is measured from an amount obtained by subtracting the difference. The network monitoring system according to claim 1, wherein the test signal is a keep alive message used in a management protocol of the communication network. Each of the node devices further includes a combining unit that combines a plurality of notification messages for each buffer unit,
The notification unit notifies the monitoring device of the combined notification message,
The network monitoring system according to claim 1, wherein the monitoring device further comprises a decomposition unit that decomposes the notification message notified in the combined state and extracts individual notification messages. In the node device provided in a network monitoring system including a monitoring device that monitors a system including a communication network connecting a plurality of node devices based on a notification message notified from the plurality of node devices via the communication network. ,
A message generator that generates notification messages of different levels according to the type of alarm that has occurred in the device itself;
A plurality of buffer units that are provided for each different level and temporarily hold the notification message in a holding period according to the level;
A notification unit that notifies the monitoring device of the held notification message;
A test signal transmitter for transmitting a test signal for measuring a load of the monitoring device and a load of the communication network to the monitoring device;
A measuring unit that individually measures the load of the monitoring device and the communication network based on the reception time of the reply from the monitoring device to the test signal;
A node device comprising: a retention period control unit configured to change a retention period in the plurality of buffer units for each level based on the measured load of the monitoring device and the load of the communication network. The test signal describes a first field for describing a transmission time from the node device, a second field for describing an arrival time at the monitoring device, and a reply time from the monitoring device. And a third field of
The test signal transmission unit describes the transmission time in the first field and transmits the test signal,
The measuring unit measures the load of the monitoring device from the difference between the return time and arrival time described in the returned test signal, and from the difference between the reception time and the transmission time described in the test signal. The node device according to claim 5, wherein a load of the communication network is measured from an amount obtained by subtracting the difference. The node device according to claim 5, wherein the test signal is a keep alive message used in a management protocol of the communication network. 6. The node device according to claim 5, further comprising a combining unit that combines a plurality of notification messages for each buffer unit. In a monitoring device that monitors a system including a communication network connecting a plurality of node devices based on a notification message notified from the plurality of node devices via the communication network,
A transmission / reception unit that receives a test signal transmitted from the node device to measure the load on the monitoring device and the load on the communication network, and returns a response to the test signal in the test signal. A monitoring device characterized by. The test signal describes a first field for describing a transmission time from the node device, a second field for describing an arrival time at the monitoring device, and a reply time from the monitoring device. And a third field of
The transmission / reception unit returns the test signal in which the arrival time at the monitoring device is described in the second field and the return time from the monitoring device is described in the third field. 9. The monitoring device according to 9. The monitoring apparatus according to claim 9, wherein the test signal is a keep alive message used in a management protocol of the communication network. The monitoring apparatus according to claim 9, further comprising a decomposing unit that decomposes the notification message notified in the combined state and extracts each notification message.

Images